Description (CNA)
GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title field when creating or editing a report, and the payload executes when staff members view and click the affected report link in the Manage Reports interface.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| GFI Software / HelpDesk | affected 0 before 4.99.10 |
CWE
CWE-79
References
- https://gfi.ai/products-and-solutions/email-and-messaging-solutions/helpdesk/resources/product-releases
- https://www.vulncheck.com/advisories/gfi-helpdesk-stored-xss-via-reports-module
ADP enrichment
No English description supplied.
No references supplied.